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I. Basis of the report 

1 . With regard to the elements of the international application (Replacement sheets which have been ft«nfefi~# *~ 
thereceivmg Office in response to an invitation under Article 14 are referred to * m 7nMJ^SS£SffSl? 
and are not annexed to this report since they do not contain amendments (Rules 7C 116 and 70. 17)f Y ° d 



Description, Pages 

1-14 

Claims, Numbers 
1-21 

Drawings, Sheets 

1/6-6/6 



as originally filed 



as originally filed 



as originally filed 



2. With regard to the language, all the elements marked above were available or furnished to this Authnrih, in th a 
language .n which the international application was filed, unless otherwise indicated SSShto il^^ 

These elements were available or furnished to this Authority in the following language: , which is: 

□ the language of a translation furnished for the purposes of the international search (under Rule 23.1 (b)). 

□ the language of publication of the international application {under Rule 48.3(b)). 

D fS£SS^?SS!! BaXXX fUmiShed f ° r the PUrP ° SeS ° f international Preliminary examination (under 
3 - appiication, the 

□ contained in the international application in written form. 

□ filed together with the international application in computer readable form. 

□ furnished subsequently to this Authority in written form. 

□ furnished subsequently to this Authority in computer readable form. 

° ™trng^bTent!nS° rma,l0n C ° nnpUter readable ,orm is lden,iK " «° ,h * ~*-n» 

4. The amendments have resulted in the cancellation of: 

□ the description, pages: 

□ the claims, Nos.: 

□ the drawings, sheets: 
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5. □ This report has been established as if (some of) the amendments had not been made, since they have 

been considered to go beyond the disclosure as filed (Rule 70.2(c)). 

(Any replacement sheet containing such amendments must be referred to under item 1 and annexed to this 
report.) 

6. Additional observations, if necessary: 



V. Reasoned statement under Article 35(2) with regard to novelty, inventive step or industrial applicability; 
citations and explanations supporting such statement 

1. Statement 



Novelty (N) 


Yes: 


Claims 


1-19, 21 




No: 


Claims 


20 


Inventive step (IS) 


Yes: 


Claims 


1-19, 21 




No: 


Claims 


20 


Industrial applicability (IA) 


Yes: 


Claims 


1-21 




No: 


Claims 





2. Citations and explanations 
see separate sheet 
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Cited documents: 

D1 : US-A-6 055 236 (BORELLA MICHAEL S ET AL) 25 April 2000 (2000-04-25) 
D2: EP-A-1 035 702 (SUN MICROSYSTEMS INC) 1 3 September 2000 (2000- 09-1 3) 
D3: XP-000740492: "Internal Firewalls can protect subnetworks from unauthorized 

access") Ning Sun. COMPUTER TECHNOLOGY REVIEW, WESTWORLD 

PRODUCTION CO. LOS ANGELES, US. 01-06-1997 



V. Reasoned statement under Article 35(2) with regard to novelty, inventive 
step or industrial applicability; citations and explanations supporting such 
statement. 



1 . Independent claim 20 is formulated in such broad terms that its subject matter 
appears to be entirely anticipated by the content of document D1 . Therefore the 
subject-matter of independent claim 20 is not new in the sense of Article 33(2) 
PCT. Indeed document D1 discloses, according to all the features of claim 20, 

a public key server comprising: 

storage means for storing information in regard to a public key; 
a public key request interface for receiving a request for public key information 
stored in said public key information storage means and transmitting the 
requested information to a requesting device in response thereto (Column 35, 
lines 12-22: " In one exemplary preferred embodiment of the present invention, 
at Step 346, the digital certificate is published in a location accessible to external 
network devices on external networks 30. In order for an external network device 
to use the certificate, it is published in a way that allows the external network 
device to retrieve it. For example, it might be stored in a Lightweight Directory 
Access Protocol ("LDAP") directory under a name representing the service. Other 
storage options are also possible, such as storing the digital certificates in a 
public file, in a public database or on a network server are accessible to the 
external network"); 
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wherein said storage means stores a public network address of a gateway as a 
destination address of data to be transmitted to a recipient, for gateways 
identifying the recipient by means of a public key identifier included in the 
transmitted data and forwarding the data to the recipient; and said public key 
request interface is adapted to transmit said stored public network gateway 
address to the requesting device (Column 5, lines 1 1-25: "The digital certificate 
includes a network address valid outside an internal distributed network address 
translation network, service name, service parameters and an optional public 
encryption key. One or more of the service parameters may be obtained with a 
Port Allocation Protocol used for distributed network address translation. The 
digital certificate is signed with a secure digital signature. The digital certificate is 
published in a location on the internal network accessible to external network 
devices on external networks. The digital certificate is used by an external 
network device to request a desired service from an internal network device on 
the internal distributed network address translation network. In one exemplary 
preferred embodiment of the present invention, the digital certificate is a public 
encryption key certificate for an Internet Protocol security service."). 

Furthermore, it should be noted that even if novelty of claim 20 could be argued, 
based on minor differences between the features of claim 20 and those disclosed 
in D1 , the subject matter of claim 1 would not involve an inventive step, Article 
33(3), having regard to the disclosure of D1 as this document discloses the same 
object and the same type of solution as the present application. 



2. The subject-matter of the independent claims 1, 14 and 21 meets the 
requirements of Article 33 (1), (2) and (3) PCT regarding novelty and inventive 
step. 

These claims relate to a gateway (independent claim 1), a system (independent 
claim 14) and a method (independent claim 21) for transmitting. data between a 
remote device in a public network and an internal device in an internal network 
using asymmetric keys. 
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The closest prior art is the US Patent 6055236, which describes a method for 
allowing services to be identified and requested on an internal distributed network 
address translation network. Each internal network device requests from the 
router a set of locally unique ports for external communication with external 
devices. Ephemeral ports are replaced by a combination network address 
including a locally unique port and a common external network address. 

The problem with the method disclosed in the US Patent 6055236 is that the 
network address translation using locally unique ports for external communication 
with external devices, particularly by using a fixed port mapping of internal 
devices maintained by the router, implies that the position and configuration of 
internal services and devices has to be fixed. It is therefore not optimized with 
regard to the number of required addresses. 

In contrast the present invention does not require fixed IP addresses and fixed 
port mappings that have to be included as additional payload in a certificate for 
identifying internal devices of an internal network. Instead, the present 
independent claims teach that the destination of incoming data that is addressed 
to the gateway can be identified using public key information. Such public key 
information may already be included in a certificate and thus, no additional 
payload has to be included and no additional unique identifiers, such as a fixed 
port allocation, have to be generated and maintained for this purpose. 

Claims 1,14 and 21 disclose a gateway, a system and a method which uses 
public key identifiers for identifying the internal destination of received data 
reusing said data field and avoiding additional data to be determined. The 
number of IP addresses is reduced by using a gateway forwarding data to an 
internal device based on a public key information (which is globally unique ) 
included in the transmitted data for identifying the internal device. 

There is no indication of this solution in neither US Patent 6055236 nor in the 
other 7 documents listed in the European Search Report. US Patent 6055236 
discloses the usage of a SPI (Security Parameter lndex)-to-internal network 
address table in Fig. 21 , but it is not used to identify the address of the internal 
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devices, but to identify the SPI values when being presented with the internal 
network address of these devices. The identification of the internal destination 
device of incoming data by the router is however completely unrelated to the SPI 
values stored in the table shown in FIG. 21 . In fact, these values are only used 
for establishing a secure connection between an external device and an internal 
device, i.e. after the router has established the connection. 

Therefore, the subject-matter of present claims 1,14 and 21 is considered to be 
hovel and inventive. 



3. Claims 2-1 3 and 1 5-1 9 are dependent from claims 1 and 1 4 and comply therefore 
with the requirements of Article 33 (1 ), (2) and (3) PCT. 



4. The independent claims are not properly cast in the two-part form, with those 
features which in combination are part of the prior art (see document D1), being 
placed in the preamble (Rule 6.3(b) PCT). 



Documents D1-D3 have not been identified in the description and the relevant 
background art disclosed therein was not briefly discussed (Rule 5.1 (a)(ii) PCT). 



Reference signs in parentheses are not inserted in the claims to increase their 
intelligibility, Rule 6.2(b) PCT. This applies to both the preamble and 
characterising portion. 



Following from the disclosure of documents D1 -D3, the statement indicating the 
technical problem to be solved by the invention was not revised. 
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8. Independent claims 1 ,14 and 20 do not meet the requirements of Article 6 PCT 
in that it is not clear which category the claims are referring to. 

In this case of claims containing both process and apparatus features, the 
applicant is asked to amend the claims in such a way that it is clearly in one or 
the other category. 

In this connection, functional features used to define physical entities (e.g. 
"means for..." of "means arranged in such a way as to...") should be interpreted 
as features of an apparatus whereas features relating to activities in which the 
use of a physical entity is implied (e.g. doing something by means of) should be 
regarded as features of a process. 



9. Claim 21 is not clear due to what seems to be a clerical error: "..in a gateway of 
the internal device..." (lines 3 and 6) should presumably read "...in a gateway of 
the internal network...". 



1 0. It has to be said that description pages 1 3 and 1 4, figure 1 1 and claims 7-1 3,18 
and 19 introduce subject-matter which extends beyond the content of the priority 
document pertaining to the present application (Article 19(2) PCT). Hence, since 
claims 7-13, 18 and 19 are based on description pages 13 and 14, they don't 
enjoy priority rights from the filing date of the priority document. 
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